Empire PowerShell UAC Bypass via Registry Key

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•21

Detects specific command-line patterns associated with Empire PowerShell UAC bypass methods. These patterns involve PowerShell commands designed to retrieve and execute content from the 'Update' registry key within 'HKCU:Software\Microsoft\Windows Update', which is a known technique used by Empire for privilege escalation.